Bad_SecurityChecksFailed,message = An error occurred verifying security

[cptjackwu]

I use milo 0.6.5 and use milo-example create opcuaClient ，just modify Client.class content

public interface Client {

default String getEndpointUrl() {
    return "opc.tcp://192.168.188.100:55101";
}

default Predicate<EndpointDescription> endpointFilter() {
    return e -> getSecurityPolicy().getUri().equals(e.getSecurityPolicyUri());
}

default SecurityPolicy getSecurityPolicy() {
    return SecurityPolicy.Aes128_Sha256_RsaOaep;
}

default IdentityProvider getIdentityProvider() {
    return new UsernameProvider("*****","*****");
}

void run(OpcUaClient client, CompletableFuture<OpcUaClient> future) throws Exception;

}

fault:

7:21:43.099 [main] DEBUG org.eclipse.milo.opcua.sdk.client.OpcUaClient - Added ServiceFaultListener: org.eclipse.milo.opcua.sdk.client.session.SessionFsmFactory$SessionFaultListener@af9a89f
17:21:43.272 [main] DEBUG org.eclipse.milo.opcua.sdk.client.OpcUaClient - Added SessionActivityListener: org.eclipse.milo.opcua.sdk.client.subscriptions.OpcUaSubscriptionManager$1@76f856a8
17:21:43.417 [milo-shared-thread-pool-2] DEBUG org.eclipse.milo.opcua.stack.client.ChannelFsm - [1] S(NotConnected) x E(Connect) = S'(Connecting)
17:21:43.428 [milo-netty-event-loop-1] DEBUG org.eclipse.milo.opcua.stack.client.transport.uasc.UascClientAcknowledgeHandler - Sent Hello message on channel=[id: 0x88c3a61e, L:/192.168.188.104:58313 - R:WIN-THQI4ELR952/192.168.188.100:55101].
17:21:43.429 [milo-netty-event-loop-1] DEBUG org.eclipse.milo.opcua.stack.client.transport.uasc.UascClientAcknowledgeHandler - Received Acknowledge message on channel=[id: 0x88c3a61e, L:/192.168.188.104:58313 - R:WIN-THQI4ELR952/192.168.188.100:55101].
17:21:43.429 [milo-netty-event-loop-1] DEBUG org.eclipse.milo.opcua.stack.client.transport.uasc.UascClientMessageHandler - OpenSecureChannel timeout scheduled for +5000ms
17:21:43.435 [milo-nonce-util-secure-random] INFO org.eclipse.milo.opcua.stack.core.util.NonceUtil - SecureRandom seeded in 0ms.
17:21:43.450 [milo-shared-thread-pool-0] DEBUG org.eclipse.milo.opcua.stack.client.transport.uasc.UascClientMessageHandler - Sent OpenSecureChannelRequest (Issue, id=0, currentToken=-1, previousToken=-1).
17:21:43.459 [milo-netty-event-loop-1] ERROR org.eclipse.milo.opcua.stack.client.transport.uasc.UascClientAcknowledgeHandler - [remote=WIN-THQI4ELR952/192.168.188.100:55101] Received error message: ErrorMessage{error=StatusCode{name=Bad_SecurityChecksFailed, value=0x80130000, quality=bad}, reason=null}
17:21:43.473 [milo-shared-thread-pool-0] DEBUG org.eclipse.milo.opcua.stack.client.ChannelFsm - [1] S(Connecting) x E(ConnectFailure) = S'(ReconnectWait)
17:21:43.476 [main] ERROR com.eline.opcua.config.ClientRunner - Error running client example: UaException: status=Bad_SecurityChecksFailed, message=An error occurred verifying security.
java.util.concurrent.ExecutionException: UaException: status=Bad_SecurityChecksFailed, message=An error occurred verifying security.
at java.base/java.util.concurrent.CompletableFuture.reportGet(CompletableFuture.java:395)
at java.base/java.util.concurrent.CompletableFuture.get(CompletableFuture.java:1999)
at com.eline.opcua.util.Read.run(Read.java:36)
at com.eline.opcua.config.ClientRunner.run(ClientRunner.java:119)
at Test.main(Test.java:14)

[kevinherron]

The remote server is responding with a channel-level Error with StatusCode Bad_SecurityChecksFailed.

The most common reason for this would be that you haven't configured that server to trust your client's certificate yet.

[kevinherron]

It looks like only the real CertificateValidator implementations use the TrustListManager right now, so it should be okay to not configure it.

[Magniveo]

Ok, im tried, its not solve, how use it?

ClientCertificateValidator clientCertificateValidator = new ClientCertificateValidator.InsecureValidator();
        clientCertificateValidator.validateCertificateChain(Arrays.asList(loader.getClientCertificateChain())
                ,"urn:mypc:pcmy:opctest:client",this.getEndpoint());

[kevinherron]

@Magniveo when building the client config object call setCertificateValidator() with the InsecureValidator instance you created.

[Magniveo]

Yes, I know about it. Unfortunately, it does not work. Error server in the method validateCertificateChain
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
What i do wrong?
.setCertificateValidator(clientCertificateValidator)

[Magniveo]

Okay, need added it to server too.